Tornado up to 3.2.1 information exposure

Summaryinfo

A vulnerability categorized as problematic has been discovered in Tornado up to 3.2.1. This affects an unknown part. The manipulation results in information exposure. This vulnerability is known as CVE-2014-9720. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Tornado up to 3.2.1. It has been classified as problematic. Affected is an unknown functionality. The manipulation with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. CVE summarizes:

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

The weakness was published 04/22/2023 as 1c36307463b1e8affae100bf9386948e6c1b2308. The advisory is available at github.com. This vulnerability is traded as CVE-2014-9720 since 05/19/2015. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 84096 (Fedora 21 : python-tornado-3.2.2-1.fc21 (2015-8606)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 123622 (Fedora Security Update for python-tornado (FEDORA-2015-8606)).

Upgrading to version 3.2.2 eliminates this vulnerability. The upgrade is hosted for download at tornadoweb.org. Applying the patch 1c36307463b1e8affae100bf9386948e6c1b2308 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (84096). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Tornado

Version

• 3.2.0
• 3.2.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion